Login Request a demo
PR
Product
PrestaShop
by PrestaShop · last CVE Sep 7, 2026
95
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities95In the news0Timeline
Severity mix
Critical 22High 13Medium 49Low 1
Severity
All severities95Critical22High13Medium49Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add PrestaShop to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-30838
9.9
1%
Apr 25
PrestaShop is an Open Source e-commerce web application
Affected: before 1.7.8.9; 8.0.0 before 8.0.4
CVE-2023-39526
9.8
2%
Aug 7
PrestaShop is an open source e-commerce web application
Affected: before 1.7.8.10; 8.0.0 before 8.0.5; 8.1.0
CVE-2023-39524
9.8
1%
Aug 7
PrestaShop is an open source e-commerce web application
Affected: before 8.1.1
CVE-2022-31181
9.8
7%
Aug 1
Remote code execution in prestashop
Affected: >= 1.6.0.10, < 1.7.8.7
CVE-2022-21686
9.8
2%
Jan 26
PrestaShop is an Open Source e-commerce platform
Affected: 1.7.0.0 through 1.7.8.3
CVE-2021-43789
9.8
5%
Dec 7
PrestaShop is an Open Source e-commerce web application
Affected: 1.7.5.0 before 1.7.8.2
CVE-2021-3110
9.8
19%
Jan 20
The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_products[] parameter
Affected: 1.7.7.0
CVE-2020-15160
9.8
11%
Sep 24
PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location parameter
Affected: 1.7.5.0 before 1.7.6.8
CVE-2020-4074
9.8
2%
Jul 2
In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is able to forge requests and execute admin commands
Affected: 1.5.0.0 before 1.7.6.6
CVE-2013-6295
9.8
2%
Feb 18
PrestaShop 1.5.5 vulnerable to privilege escalation via a Salesman account via upload module
Affected: 1.5.5.0
CVE-2019-19595
9.8
4%
Dec 5
reset/modules/advanced_form_maker_edit/multiupload/upload.php in the RESET.PRO Adobe Stock API integration 4.8 for PrestaShop allows remote attackers to execute arbitrary code by…
Affected: 1.6; 1.7
CVE-2019-19594
9.8
4%
Dec 5
reset/modules/fotoliaFoto/multi_upload.php in the RESET.PRO Adobe Stock API Integration for PrestaShop 1.6 and 1.7 allows remote attackers to execute arbitrary code by uploading a…
Affected: 1.6; 1.7
CVE-2018-19355
9.8
3%
Nov 19
modules/orderfiles/ajax/upload.php in the Customer Files Upload addon 2018-08-01 for PrestaShop (1.5 through 1.7) allows remote attackers to execute arbitrary code by uploading a…
Affected: 1.5.0.0 through 1.7.0.0
CVE-2018-19126
9.8
23%
Nov 9
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file upload
Affected: 1.6.0.1 before 1.6.1.23; 1.7.0.0 before 1.7.4.4
CVE-2018-8824
9.8
1%
May 10
modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to…
Affected: 1.5.5.0 through 1.7.2.5
CVE-2018-8823
9.8
50%
Mar 28
modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to…
Affected: 1.5.5.0 through 1.7.2.5
CVE-2026-44212
9.3
0%
May 14
PrestaShop: Stored XSS executable in customer service view
Affected: < 8.2.6; >= 9.0.0-alpha.1, < 9.1.1
CVE-2023-39530
9.1
1%
Aug 7
PrestaShop is an open source e-commerce web application
Affected: before 8.1.1
CVE-2023-39529
9.1
1%
Aug 7
PrestaShop is an open source e-commerce web application
Affected: before 8.1.1
CVE-2023-39525
9.1
1%
Aug 7
PrestaShop is an open source e-commerce web application
Affected: before 8.1.1
CVE-2021-21308
9.1
2%
Feb 26
PrestaShop is a fully scalable open source e-commerce solution
Affected: after 1.5.0.0 before 1.7.7.2
CVE-2018-13784
9.1
16%
Jul 9
PrestaShop before 1.6.1.20 and 1.7.x before 1.7.3.4 mishandles cookie encryption in Cookie.php, Rinjdael.php, and Blowfish.php
Affected: before 1.6.1.20; 1.7.0.0 before 1.7.3.4
CVE-2023-30839
8.8
2%
Apr 25
PrestaShop is an Open Source e-commerce web application
Affected: before 1.7.8.9; 8.0.0 before 8.0.4
CVE-2023-25170
8.8
0%
Mar 13
PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF)
Affected: before 8.0.1
CVE-2020-15082
8.8
1%
Jul 2
In PrestaShop from version 1.6.0.1 and before version 1.7.6.6, the dashboard allows rewriting all configuration variables
Affected: 1.6.0.1 before 1.7.6.6
CVE-2013-6358
8.8
4%
Jan 23
PrestaShop 1.5.5 allows remote authenticated attackers to execute arbitrary code by uploading a crafted profile and then accessing it in the module/ directory
Affected: 1.5.5.0
CVE-2018-20717
8.8
3%
Jan 15
In the orders section of PrestaShop before 1.7.2.5, an attack is possible after gaining access to a target store with a user role with the rights of at least a Salesman or higher…
Affected: before 1.7.2.5
CVE-2023-39528
8.6
1%
Aug 7
PrestaShop is an open source e-commerce web application
Affected: before 8.1.1
CVE-2024-41651
8.1
1%
Aug 12
An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary code via the module upgrade functionality
Affected: through 8.1.7
CVE-2020-26224
7.5
2%
Nov 16
In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows a shopping cart to…
Affected: before 1.7.6.9
CVE-2019-13461
7.5
2%
Jul 9
In PrestaShop before 1.7.6.0 RC2, the id_address_delivery and id_address_invoice parameters are affected by an Insecure Direct Object Reference vulnerability due to a guessable…
Affected: through 1.7.5.2; 1.7.6.0; 1.7.6.0
CVE-2018-19125
7.5
11%
Nov 9
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to delete an image directory
Affected: 1.6.0.1 before 1.6.1.23; 1.7.0.0 before 1.7.4.4
CVE-2018-19124
7.5
3%
Nov 9
PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 on Windows allows remote attackers to write to arbitrary image files
Affected: 1.6.0.1 before 1.6.1.23; 1.7.0.0 before 1.7.4.4
CVE-2018-7491
7.5
1%
Feb 26
In PrestaShop through 1.7.2.5, a UI-Redressing/Clickjacking vulnerability was found that might lead to state-changing impact in the context of a user or an admin, because the…
Affected: through 1.7.2.5
CVE-2021-21302
7.2
2%
Feb 26
PrestaShop is a fully scalable open source e-commerce solution
Affected: after 1.5.0.0 before 1.7.7.2
CVE-2026-84186
6.9
1%
Sep 7
Incorrect access control in PrestaShop
Affected: before 9.1.5; before 8.2.8
CVE-2025-25692
6.5
1%
Jul 30
A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request
Affected: 8.2.0
CVE-2025-25691
6.5
1%
Jul 30
A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request
Affected: 8.2.0
CVE-2023-30545
6.5
1%
Apr 25
PrestaShop is an Open Source e-commerce web application
Affected: before 1.7.8.9; 8.0.0 before 8.0.4
CVE-2020-5293
6.5
1%
Apr 20
In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and specific prices
Affected: after 1.7.0.0 before 1.7.6.5
CVE-2020-5288
6.5
1%
Apr 20
"In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there is improper access controls on product attributes page
Affected: after 1.7.0.0 before 1.7.6.5
CVE-2020-5287
6.5
1%
Apr 20
In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is improper access control on customers search
Affected: after 1.5.5.0 before 1.7.6.5
CVE-2020-5279
6.5
1%
Apr 20
In PrestaShop between versions 1.5.0.0 and 1.7.6.5, there are improper access control since the the version 1.5.0.0 for legacy controllers
Affected: after 1.5.0.0 before 1.7.6.5
CVE-2020-5250
6.3
1%
Mar 5
In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal someone else's address
Affected: 1.7.0.0 before 1.7.6.4
CVE-2024-34716
6.1
56%
May 14
PrestaShop is an open source e-commerce web application
Affected: 8.1.0 before 8.1.6
CVE-2024-21628
6.1
0%
Jan 2
PrestaShop is an open-source e-commerce platform
Affected: before 8.1.3
CVE-2024-21627
6.1
1%
Jan 2
PrestaShop is an open-source e-commerce platform
Affected: before 1.7.8.11; 8.0.0 before 8.1.3
CVE-2023-39527
6.1
1%
Aug 7
PrestaShop is an open source e-commerce web application
Affected: before 1.7.8.10; 8.0.0 before 8.0.5; 8.1.0
CVE-2012-20001
6.1
1%
Dec 21
PrestaShop before 1.5.2 allows XSS via the "<object data='data:text/html" substring in the message field
Affected: before 1.5.2
CVE-2020-15161
6.1
1%
Sep 24
In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form
Affected: 1.6.0.4 before 1.7.6.8
Page 1 of 2 · 95 total
12